I have a node.js app that is deployed to Elastic Beanstalk (EB), which uses nginx as a reverse proxy. Nothing fancy there, just used EB with a Docker config. I then added my EB's location, e.g. **.elasticbeanstalk.com as a CNAME in Cloudflare, and enabled SSL.

In my app I set:

app.set("trust proxy", 2) // What is the right value here?
sessionCookie = {
  httpOnly: true,
  secure: true, 
  maxAge: 24 * 60 * 60 * 1000
}

I've experimented with all of the below and all of which do not work:

app.set("trust proxy", 1) // or 2,3,4
app.set("trust proxy", ["loopback", "linklocal", "uniquelocal"])
app.set("trust proxy", function(ip) { return true })
app.set("trust proxy", true)

Any suggestions? If secure is set to false, then it works, but I don't think it's wise to set secure to false?